Imaging to a file on an encrypted drive with TaskForce 2

Create encrypted storage

To image into files on an encrypted target drive, connect the source drive to a port in the Source mode and take these steps:

1. In the TaskForce main window, click Image.
2. Select a source device.
3. Optional: On the Imaging sessions page, click Start new.
4. On the Select target devices panel, switch to the Files tab and click Create file.
5. In the Select image file window, click Add storage.

6. On the Select device panel, switch to the Drives tab and choose the drive connected to a port in the Target mode.
7. Select Create an encrypted VeraCrypt container (exFAT) and click Next.

8. Enter and confirm the password for the encrypted volume on the drive. Then click Create.

9. Confirm the formatting of the device by entering YES and clicking OK. After this step, the formatting takes a few seconds.
10. Click + Create file.
11. Enter the name of the image file and choose the file format (E01, raw, img or dd). Then click Create.

12. Once you have created the file, you may add more image files in the same or a different folder.

After you click Continue, TaskForce 2 images the evidence into the file on your encrypted target.

Upon completion of the imaging session, check the Imaging completed report.

Extract data from an encrypted volume

To find the VeraCrypt volume and the imaged file, do the following:

1. Plug the target drive into your computer.
2. Use VeraCrypt software to safely access encrypted data from your drive.
3. Select the drive label (A, B, C, etc.) on which you want the volume to be mounted.
4. Click Select device.
5. In the pop-up window, select your encrypted volume.
6. Click Mount. Now you can view the partition name, size and encryption algorithm.
7. Use the password set prior to the imaging session to get access to the encrypted volume.

After you enter the password, the volume is mounted and you can access it from Windows Explorer and use the image for subsequent operations.